{"id":18008185,"url":"https://github.com/lanefu/clammy-ng","last_synced_at":"2025-07-01T13:39:46.510Z","repository":{"id":190864857,"uuid":"683468823","full_name":"lanefu/clammy-ng","owner":"lanefu","description":"The next generation ansible-managed linux router framework using all the trendy new things","archived":false,"fork":false,"pushed_at":"2024-08-18T16:18:47.000Z","size":13889,"stargazers_count":10,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-21T19:12:09.620Z","etag":null,"topics":["ansible","armbian","firewall","foomuuri","linux","nftables","router","sbc","single-board-computers","systemd"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lanefu.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-08-26T17:08:34.000Z","updated_at":"2024-08-18T16:18:50.000Z","dependencies_parsed_at":null,"dependency_job_id":"9037e670-df36-4418-be25-a8d3a74bfd2a","html_url":"https://github.com/lanefu/clammy-ng","commit_stats":null,"previous_names":["lanefu/clammy-ng"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lanefu%2Fclammy-ng","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lanefu%2Fclammy-ng/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lanefu%2Fclammy-ng/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lanefu%2Fclammy-ng/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lanefu","download_url":"https://codeload.github.com/lanefu/clammy-ng/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245654314,"owners_count":20650843,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","armbian","firewall","foomuuri","linux","nftables","router","sbc","single-board-computers","systemd"],"created_at":"2024-10-30T01:17:46.631Z","updated_at":"2025-03-26T12:32:03.845Z","avatar_url":"https://github.com/lanefu.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# clammy-ng\nThe next generation ansible-managed linux router framework using all the trendy new things\n\n## preface\n\nIf you dislike systemd. This project is not for you.\n\n## intro\n\nCurrent device target is a nanopi-r5s running Armbian using a WAN port for internet, and then LAN1 and LAN2 aggregated in a [Router on a stick](https://en.wikipedia.org/wiki/Router_on_a_stick) pattern for east-west traffic.   \n\nThis should work on a standard ARM or x86 debian linux system.  Currently targeted at bleeding edge debian side.. Bookworm should work fine.\n\nDesire is to have a robust router config with zone firewall leveraging the following underlying components\n\n*  netplan\n*  ~~firewalld~~ [foomuuri](https://github.com/FoobarOy/foomuuri)\n*  dnsmasq\n*  frrouting\n*  wireguard\n\n## functionality status\n\nCurrently works:\n\n* wan configuration\n* bonidng/LACP config \n* vlan support\n* dhcp zones\n* dns \n* zone firewall policies\n* dynamic dns client setup\n* helper script for leases\n* armbian adjustments\n  * irqbalance\n  * schedutil governor\n* install some helpful tools\n  * mtr \n  * bmon\n  * vnstat\n  * lnav\n  * dig\n  * batcat\n  * clammy_leases.sh\n\n## getting started\n\nThis repo is meant to be the ansible project directory.. or close to it plus documentation..  Trying to leverage off-the-shelf roles when possible.  Other roles will via the [clammy collection](https://github.com/lanefu/ansible-collection-clammy)\nThe roles in the clammy collection need README.md updates, but the defaults/main.yml are very understandable. code should be straight forward\n\n### environment setup\n\nthere are better ways, but this way for now...  `.gitignore` has been preconfigured to use namedspace ansible home `~/.clammy-ng-ansible/` and `venv` used in the example.\n\n#### requirements\n\nassume you have python3 and python3-venv installed\n\n```\npython3 -m venv venv\nsource venv/bin/activate\npython3 -m pip install -r requirements.txt\nansible-galaxy install -r requirements.yml\nansible-galaxy install -r requirements-clammy-ng.yml \n```\n\n## approach notes\n\n* everything should be ansible role driven\n* only roles in calling playbook ex: full.yml\n* all config driven by host_vars or group_vars\n\n### tool selection\n\n* try to use modern linux tools\n* no large daemons \n* friendly tui for looking at state on router\n* use things like node_exporter and dnsmasq_exporter for visualizing externally\n\n### order of operations\n\nNaturally there's some sequencing challenges with a router.. especially out of the box.  For now `full.yml` is the POC full sequence of operations.\nin reality, this stuff will proably want to be decoupled...  \n\nI think there's going to be a generally need to decouple WAN interface-oriented operations from LAN, including firewall management.\n\napproach so far:\n\n1. sanitize some armbian stuff such as removing NetworkManager\n1. sysctl_base config # interface specific stuff might move this\n1. configure wan interface\n1. configure lan interfaces\n1. configure vpn interfaces\n1. configure wan firewall ingress and port forwards\n1. configure lan/vpn zones\n1. configure wan/vpn zone policies\n1. configure DHCP / DNS (dnsmasq)  # what happens if vpn needs DNS to work?\n1. configure advanced routing (frrouting)\n1. extra ammenitities\n1. configure monitoring\n\n\n## demo and screenshots\n\nUpdating firewall demo with ansible / clammy-ng\n\n![firewalldemo](docs/assets/screenshots/firewall_demo01.gif)\n\nClean interface names thanks to netplan\n\n![](docs/assets/screenshots/interface_names.png)\n\nHandy Script to view dhcp leases\n\n![](docs/assets/screenshots/clammy_leases.png)\n\nFilter live firewall logs easily with lnav\n\n![](docs/assets/screenshots/firewall_logs_lnav.png)\n\nBandwidth Monitoring with bmon\n\n![](docs/assets/screenshots/bmon.png)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flanefu%2Fclammy-ng","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flanefu%2Fclammy-ng","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flanefu%2Fclammy-ng/lists"}